{"id":103660,"date":"2022-03-31T09:36:38","date_gmt":"2022-03-31T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah"},"modified":"2022-03-31T09:36:38","modified_gmt":"2022-03-31T07:36:38","slug":"kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","title":{"rendered":"Kritisk 0-dages s\u00e5rbarhed i Spring Framework, der anvendes i mange Java-projekter.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
I Spring Core-modulet, som leveres med Spring Framework, er der blevet opdaget en kritisk 0-dags s\u00e5rbarhed, der giver en uautoriseret fjernangriber mulighed for at eksekvere sin kode p\u00e5 serveren. Det er endnu uvist, hvor katastrofale konsekvenser den opdagede problemstilling kan have, og om angrebene vil v\u00e6re s\u00e5 omfattende som i tilf\u00e6lde af s\u00e5rbarheden i Log4j 2. S\u00e5rbarheden er blevet tildelt kodeordet Spring4Shell, men der er endnu ikke tildelt et CVE-id. I Spring Framework forbliver problemet ubehandlet, og der findes allerede flere fungerende prototyper af exploits (1, 2, 3, 4) p\u00e5 internettet. Problemet forv\u00e6rres af, at mange erhvervslivets Java-applikationer baseret p\u00e5 Spring Framework k\u00f8rer med root-rettigheder, og s\u00e5rbarheden muligg\u00f8r en fuldst\u00e6ndig kompromittering af systemet. <\/p>\n
If certain estimates are to be believed, the Spring Core module is used in 74% of Java applications. The danger of the vulnerability is mitigated by the fact that only applications using the annotation @RequestMapping when connecting request handlers and binding web form parameters in the format name=value (POJO, Plain Old Java Object) are affected, as opposed to those using JSON\/XML. <\/p>\n
It is still unclear which specific Java applications and frameworks are affected by the issue. The vulnerability prevents the addition of the fields \u2018class\u2019, \u2018module\u2019, and \u2018classLoader\u2019 to a blacklist or the use of an explicit whitelist of allowed fields. Exploitation of the vulnerability is only possible when using Java\/JDK 9 or a more recent version. The problem is caused by the ability to bypass protections against the vulnerability CVE-2010-1622, which was fixed in the Spring Framework back in 2010 and is related to the execution of the classLoader handler when parsing request parameters. <\/p>\n
The operation of the exploit boils down to sending a request with the parameters \u2018class.module.classLoader.resources.context.parent.pipeline.first.*\u2019, the processing of which leads to the creation of a JSP file in the root environment of Apache Tomcat and the writing of the specified code from the attacker into that file. The created file becomes accessible for direct requests and can be used as a web shell. To attack a vulnerable application in the Apache Tomcat environment, it is sufficient to send a request with certain parameters using the curl utility. curl -v -d \u2018class.module.classLoader.resources.context.parent.pipeline.first.pattern=code_to_insert_into_file & class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp & class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps\/ROOT & class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar & class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=\u2019 http:\/\/localhost:8080\/springmvc5-helloworld-exmaple-0.0.1-SNAPSHOT\/rapid7 <\/p>\n
Det omhandlede problem i Spring Core b\u00f8r ikke forveksles med de nyligt opdagede s\u00e5rbarheder CVE-2022-22963 og CVE-2022-22950. Det f\u00f8rste problem ber\u00f8rer Spring Cloud-pakken og er blevet rettet i versionerne 3.1.7 og 3.2.3. Det andet problem findes i Spring Expression og er rettet i Spring Framework 5.3.17. Dette er principielt forskellige s\u00e5rbarheder. Om den nye s\u00e5rbarhed har udviklerne af Spring Framework endnu ikke afgivet nogen udtalelser eller offentliggjort nogen rettelse. <\/p>\n
As a temporary measure for protection, it is recommended to use a blacklist of disallowed request parameters in the code: import org.springframework.core.Ordered; import org.springframework.core.annotation.Order; import org.springframework.web.bind.WebDataBinder; import org.springframework.web.bind.annotation.ControllerAdvice; import org.springframework.web.bind.annotation.InitBinder; @ControllerAdvice @Order(10000) public class BinderControllerAdvice { @InitBinder public void setAllowedFields(WebDataBinder dataBinder) { String[] denylist = new String[]{\u2018class.\u2019, \u2018Class.\u2019, \u2018.class.\u2019, \u2018.Class.\u2019}; dataBinder.setDisallowedFields(denylist); } } \n Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"